You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The API is a single route, that by default is `/api/hellocoop`. Having a single route simplifies integration into an application. The endpoint handles the API as well as being the protocol endpoint for the OpenID Connect `redirect_uri` and third party initiated login.
12
+
The API is a single route, that by default is `/api/hellocoop`. Having a single route simplifies integration into an application. The endpoint handles the API as well as being the protocol endpoint for the OpenID Connect `redirect_uri` and third party initiated login.
13
13
14
14
The web client calls the API by passing the `op` query command set to one of the operations (`auth|login|logout|invite`)
15
15
16
16
[router.ts](src/handlers/router.ts) routes the commands to the different modules
17
17
18
-
### `auth`
18
+
### `auth`
19
19
20
20
Returns the `auth` object:
21
21
@@ -34,35 +34,32 @@ Returns the `auth` object:
34
34
}
35
35
```
36
36
37
-
38
37
Implemented in [auth.ts](src/handlers/auth.ts)
39
38
40
39
### `login`
41
40
42
-
The client loads `/api/hellocoop?op=login` to start a login flow.
41
+
The client loads `/api/hellocoop?op=login` to start a login flow.
43
42
44
43
Optional parameters described in [Web Client API](https://www.hello.dev/docs/apis/web-client/#login)
45
44
46
-
This will:
45
+
This will:
47
46
48
47
1. discover the `redirect_uri` if not configured by bouncing a page to the browser to learn the full URL for the endpoint
49
48
2. generate a PKCE `code_verifier` and `code_challenge`
50
49
3. generate a `nonce`
51
50
4. encrypt and store the `redirect_uri`, `code_verifier`, and `nonce` in the `hello_oidc` cookie
52
-
4. create an authorization request and return a 302 redirect to that URL
51
+
5. create an authorization request and return a 302 redirect to that URL
53
52
54
53
Implemented in [login.ts](src/handlers/login.ts)
55
54
56
-
57
-
### `logout`
55
+
### `logout`
58
56
59
57
The client loads `/api/hellocoop?op=logout` to clear the auth cookie and log the user out.
60
58
61
59
Optional parameters described in [Web Client API](https://www.hello.dev/docs/apis/web-client/#logout)
62
60
63
61
Implemented in [logout.ts](src/handlers/logout.ts)
64
62
65
-
66
63
### `invite`
67
64
68
65
The client loads `/api/hellocoop?op=invite` to start the invite flow.
@@ -71,13 +68,11 @@ See the [Invite API](https://www.hello.dev/docs/apis/invite/) for details.
71
68
72
69
Implemented in [invite.ts](src/handlers/invite.ts)
73
70
74
-
75
-
## OpenID Connect Protocol
76
-
71
+
## OpenID Connect Protocol
77
72
78
73
### Authorization Response
79
74
80
-
The API endpoint is the `redirect_uri` and is where the user is redirected after interacting with their Hellō Wallet.
75
+
The API endpoint is the `redirect_uri` and is where the user is redirected after interacting with their Hellō Wallet.
81
76
82
77
If a successful login at Hellō, the endpoint receives an authorization code query parameter (`code`). It then will:
83
78
@@ -88,15 +83,13 @@ If a successful login at Hellō, the endpoint receives an authorization code que
88
83
5. set the `hellocoop_auth` cookie
89
84
6. redirect the user to the `target_uri`
90
85
91
-
If the user is an administrator of the Hellō application and it is running at a dynamic endpoint and the `wildcard_console` parameter is returned,
86
+
If the user is an administrator of the Hellō application and it is running at a dynamic endpoint and the `wildcard_console` parameter is returned,
92
87
an intermediate page is generated by [wildcard.ts](src/handlers/wildcard.ts) and presented to the developer to simplify configuration of their application.
93
88
94
-
95
89
If the log in was unsuccessful or canceled, the endpoint receives an `error` query parameter and the user is redirected to an error page.
96
90
97
91
Implemented in [callback.ts](src/handlers/callback.ts)
98
92
99
-
100
93
### Third Party Initiated Login
101
94
102
95
This allows a user to log in to an application by clicking a link in a dashboard or loading a bookmark. The endpoint is passed the `iss` query parameter, which must be the Hellō issuer, `https://issuer.hello.coop`. `login_hint` or `domain_hint` can optionally be provided.
0 commit comments